CVE-2021-20427

IBM Security Guardium 11.2 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 196314...

Check your passwords! Synology NAS devices under attack from StealthWorker

Synology PSIRT Product Security Incident Response Team has put out a warning that it has recently seen and received reports about an increase in brute-force attacks against Synology devices. PSIRT suspects the botnet commonly known as StealthWorker is responsible for this increase in activity...

IBM Security Guardium 安全漏洞

IBM Security Guardium is a suite of platforms from IBM USA that provides data protection capabilities. The platform includes features such as customizable UI, report management and streamlined audit process building. IBM Security Guardium has a security vulnerability that stems from the use of...

CVE-2021-20427

IBM Security Guardium 11.2 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 196314...

A week in security (August 2 – August 8)

Last week on Malwarebytes Labs: RDP brute force attacks explained The 3 biggest threats reaching for your antivirus software’s off switch Zoom and gloom? Video comms org agrees to settle for $85m COVID-19 vaccine appointment system attacked in Italy Chrome casts away the padlock - is it good...

Design/Logic Flaw

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R08/16/32/120SFCPU firmware versions "26" and prior and Mitsubishi Electric MELSEC iQ-R series SIL2 Process CPU modules R08/16/32/120PSFCPU all versions allows a...

CVE-2021-20594

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R08/16/32/120SFCPU firmware versions "26" and prior and Mitsubishi Electric MELSEC iQ-R series SIL2 Process CPU modules R08/16/32/120PSFCPU firmware versions "11"...

Unpatched Security Flaws Expose Mitsubishi Safety PLCs to Remote Attacks

Multiple unpatched security vulnerabilities have been disclosed in Mitsubishi safety programmable logic controllers PLCs that could be exploited by an adversary to acquire legitimate user names registered in the module via a brute-force attack, unauthorizedly login to the CPU module, and even cau...

PT-2021-8030 · Mitsubishi · Melsec Iq-R Series Safety Cpu Modules R08/16/32/120Sfcpu +1

Name of the Vulnerable Software and Affected Versions: MELSEC iQ-R Series Safety CPU modules R08/16/32/120SFCPU firmware versions prior to 26 MELSEC iQ-R Series SIL2 Process CPU modules R08/16/32/120PSFCPU firmware versions prior to 11 Description: The issue is related to the exposure of sensitiv...

RDP brute force attacks explained

While you read these words, the chances are that somebody, somewhere, is trying to break in to your computer by guessing your password. If your computer is connected to the Internet it can be found, quickly, and if it can be found, somebody will try to break in. And it isnt like the movies. The...

CVE-2021-27943

The pairing procedure used by the Vizio P65-F1 6.0.31.4-2 and E50x-E1 10.0.31.4-2 Smart TVs and mobile application is vulnerable to a brute-force attack against only 10000 possibilities, allowing a threat actor to forcefully pair the device, leading to remote control of the TV settings and...

CVE-2021-27943

The pairing procedure used by the Vizio P65-F1 6.0.31.4-2 and E50x-E1 10.0.31.4-2 Smart TVs and mobile application is vulnerable to a brute-force attack against only 10000 possibilities, allowing a threat actor to forcefully pair the device, leading to remote control of the TV settings and...

Code injection

The pairing procedure used by the Vizio P65-F1 6.0.31.4-2 and E50x-E1 10.0.31.4-2 Smart TVs and mobile application is vulnerable to a brute-force attack against only 10000 possibilities, allowing a threat actor to forcefully pair the device, leading to remote control of the TV settings and...

CVE-2021-27943

The CVE-2021-27943 entry describes a brute-force vulnerability in the pairing procedure of Vizio P65-F1 (firmware 6.0.31.4-2) and E50x-E1 (firmware 10.0.31.4-2) TVs/mobile apps. An attacker can test up to 10,000 pairing possibilities to force device pairing, potentially enabling remote control of...

CVE-2021-27943

The pairing procedure used by the Vizio P65-F1 6.0.31.4-2 and E50x-E1 10.0.31.4-2 Smart TVs and mobile application is vulnerable to a brute-force attack against only 10000 possibilities, allowing a threat actor to forcefully pair the device, leading to remote control of the TV settings and...

in postfixadmin/postfixadmin

✍️ Description uniqid is used as input to MD5 when generating a PFATOKEN I'll refer to this as a session token - the function uniqid is not a CSPRNG but rather is a PRNG meaning that it cannot generate cryptographically reliable/secure values. 🕵️‍♂️ Proof of Concept Execute the below code: PHP "; ?...

Cerbrutus - Network Brute Force Tool, Written In Python

Modular brute force tool written in Python, for very fast password spraying SSH, and FTP and in the near future other network services. COMING SOON: SMB, HTTPs POST, HTTPs GET, HTTP BASIC AUTH Thanks to @0dayctf, Rondons, Enigma, and 001 fortesting and contributing Installation: cd /opt git clone...

Tennessee Valley Authority: Rate limit missing sign-in page

Vulnerability description not provided...

in erudika/scoold

✍️ Description You should check and validate the password when users registering, any user able to use a weak password like aaaaa also you don't have any rate limit for incorrect passwords that cause to easily perform Bruteforce attacks against your users that have weak passwords. 💥 Impact This...

Insecure Access Controls

github.com/argoproj/argo-cd uses insecure access controls. The Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-brute-force measures. An attacker is able to repeatedly perform authentication attempts to discover user credentials...